Security researchers have demonstrated an attack allowing hackers with privileged access to register fake MFA providers and harvest user passwords during login. The vulnerability exploits the authentication process itself.
The attack works by compromising systems with sufficient access privileges to register a malicious external multi-factor authentication (MFA) provider. When users attempt to log in, they're directed through the rogue MFA provider, which can capture their credentials before forwarding them to legitimate authentication systems.
The attack is particularly dangerous because it occurs during what users perceive as a normal login process. MFA is typically considered a security enhancement, making users less suspicious of the authentication step.
Attackers would need existing elevated access to an organization's systems to register the rogue provider, limiting the attack's scope to insider threats or compromised administrative accounts. However, once deployed, the attack could harvest passwords at scale across an organization.
The research highlights a critical gap in how external authentication providers are validated and monitored. Organizations relying on third-party MFA solutions should review provider registration controls and implement monitoring for unauthorized provider additions.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive ordering federal agencies to patch a high-severity vulnerability in Zyxel GS1900 series switches. Attackers are actively exploiting the flaw to steal data.
WordPress disclosed an unauthenticated path traversal vulnerability that could lead to conditional remote code execution. The issue affects WordPress core and has been documented in an official security advisory.
GrapheneOS, a privacy-focused Android fork, is on track to ship preinstalled on commercial devices within three years. The project has gained significant momentum in developer circles.
A Chinese-speaking threat actor has exploited vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to compromise 996 devices and steal over 18,500 database records from government systems.